T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:88- Finding
Optional Deno Installation Executes Mutable Remote Content Directly in a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
伴奏提取器
Security checks for vulnerabilities and agentic risk
Overview
This skill does the advertised audio separation work, but its default YouTube path gives yt-dlp access to the user's Chrome login cookies without a separate opt-in.
Review before installing. Use the local-file mode when possible. For YouTube downloads, do not run the default path unless you are comfortable granting yt-dlp access to your Chrome login cookies; prefer an isolated profile, a reviewed cookies file, or a modified script that only uses browser cookies after explicit consent. Install dependencies in a dedicated virtual environment and avoid the curl-to-shell Deno installer pattern.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/get_accompaniment.py:119- Finding
YouTube Downloads Access Chrome Authentication Cookies by Default
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:78- Finding
Security-Sensitive Python Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/get_accompaniment.py:131- Finding
User-Supplied URLs Are Passed to a Generic Downloader Without Host or Scheme Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (21)
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 97% confidence
- Finding
The browser-cookie extraction behavior strongly matches credential-harvesting patterns because it retrieves authentication material from the local Chrome profile. Even if the stated purpose is to authenticate yt-dlp, the capability is broader than accompaniment generation and would enable misuse of session data if repurposed or compromised.
- Content
除人声、制作卡拉OK版音频时使用。支持三种模式：(1) 歌名+歌手搜索 YouTube 下载后分离，(2) 直接提供视频 URL，(3) 处理本地音频文件。
伴奏生成器 (Accompaniment Generator)
概述
从歌曲中分离人声，输出纯伴奏音乐。核心流程：获取音频 → Demucs AI 分离人声/伴奏 → 输出 MP3。
💡 无需手动导出 cookies！ 脚本会自动从本地 Chrome 浏览器提取登录态。 只需在你自己的电脑上（已登录 Google）运行即可。
核心脚本
scripts/get_accompaniment.py使用模式
bash # 1. 搜索 YouTube + 下载 + 分离（自动用浏览器 cookies） python3 scripts/get_accompaniment.py "歌名" "歌手名" # 2. 直接提供视频 URL python3 scripts/get_accompaniment.py --url "https://youtube.com/watch?v=xxx" # 3. 处理本地音频文件 python3 scripts/get_accompaniment.py --file /path/to/song.mp3 # 4. 显式指定 cookies 文件（浏览器不�
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The documentation includes piping a remotely fetched script directly into a shell, which is a well-known unsafe pattern because it executes unverified code from the network immediately. In an agent or automation context, this can lead to arbitrary code execution and supply-chain compromise if the source is tampered with or intercepted.
- Content
macOS: brew install ffmpeg
Deno（JS 运行时，可选，用于 YouTube 签名解算）
curl -fsSL https://deno.land/install.sh | sh
text ## Agent 集成
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The '| sh' pattern chains downloaded network content straight into shell execution, removing any opportunity for review or validation. This significantly increases the risk of arbitrary command execution from compromised infrastructure or malicious modifications.
- Content
macOS: brew install ffmpeg
Deno（JS 运行时，可选，用于 YouTube 签名解算）
curl -fsSL https://deno.land/install.sh | sh
text ## Agent 集成
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 90% confidence
- Finding
The info-stealer signature is triggered because the code includes automatic browser-cookie extraction behavior, which is a common credential-harvesting pattern. Although the apparent goal is to help yt-dlp access YouTube, the capability is still sensitive and risky because it touches authenticated browser data without a narrowly justified need for the skill's core local-audio separation function.
- Content
python 3 get_accompaniment.py --url "https://youtube.com/watch?v=xxx" # 显式指定 cookies 文件 python3 get_accompaniment.py "晴天" "周杰伦" --cookies cookies.txt # 处理本地音频文件（不需要网络） python3 get_accompaniment.py --file /path/to/song.mp3 # JSON 输出（供 agent 解析） python3 get_accompaniment.py "晴天" "周杰伦" --json 💡 无需手动导出 cookies！脚本会自动从本地 Chrome 浏览器提取登录态。 如果 Chrome 不可用，再通过 --cookies 手动指定 cookies 文件。 依赖: pip install yt-dlp pip install demucs ffmpeg (系统安装: apt install ffmpeg / brew install ffmpeg) """ import sys import os import json import re import time import glob import shutil import argparse import subprocess import urllib.request import urllib.parse from pathlib import Path def log(msg): print(msg, flush=True) def find_audio_files(dir_path): exts = ['*.mp3', '*.wav', '*.flac', '*.m4a', '*.opus', '*.ogg', '*
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Reading authentication material from the local Chrome profile is a credential-access behavior that exceeds the stated purpose of generating accompaniment, especially because it is performed by default when no cookies file is supplied. This creates unnecessary exposure of the user's logged-in browser state and could enable misuse of authenticated sessions if the external tool or surrounding workflow is compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly encourages users to submit YouTube URLs and upload local audio files, but it provides no notice about how those inputs are transmitted, stored, processed, or retained. In a skill that handles user-supplied media, this omission can lead to unintended disclosure of personal or copyrighted content and prevents users from making an informed trust decision.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents capabilities that read local files, write output files, access the network, and invoke shell commands, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, this makes the skill's operational surface broader and less reviewable, increasing the chance of unintended access or unsafe execution.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatically extracting Chrome browser cookies accesses sensitive authentication material unrelated to the core task of audio separation. Even if intended only for YouTube download, this behavior can expose active session credentials and trains users to accept credential-harvesting patterns inside a media-processing skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill normalizes silent access to browser authentication data without a prominent warning or explicit consent step. In context, this is more dangerous because the skill is framed as a simple accompaniment generator, so users may not expect credential access as part of routine media processing.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md pip install demucs # ffmpeg（格式转换） # Ubuntu/Debian: sudo apt install ffmpeg # macOS: brew install ffmpeg # Deno（JS 运行时，可选，用于 YouTube 签名解算）
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script advertises accompaniment generation but silently auto-extracts authenticated Chrome cookies to access YouTube, which accesses sensitive local credential material unrelated to audio separation itself. In an agent/automation context, this is dangerous because users may trigger the skill expecting media processing while unintentionally granting browser-session access to a third-party downloader.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script normalizes automatic extraction of Chrome cookies without a prominent warning or explicit consent at the moment the behavior occurs. In skill form, this is more dangerous because users may invoke it indirectly through an agent and never realize local browser credentials are being accessed.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if output_file is None: output_file = os.path.splitext(input_file)[0] + '.mp3' try: subprocess.run( ['ffmpeg', '-y', '-i', input_file, '-q:a', '2', output_file], capture_output=True, text=True, timeout=120, check=True )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.append(video_url) try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=180) if result.returncode == 0: files = find_audio_files(output_path) if files:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.append(video_url) try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=180) if result.returncode == 0: files = find_audio_files(output_path) if files:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python for py in candidates: full_path = py if os.path.isabs(py) else py try: r = subprocess.run( [full_path, '-m', 'demucs', '--help'], capture_output=True, text=True, timeout=10 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=600) if result.returncode != 0: log(f"❌ Demucs 失败: {(result.stderr or '')[-200:]}") return None, None
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The natural-language instructions and examples are presented exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or multilingual option is provided. The file does not indicate that the skill is intentionally limited to a Chinese-speaking audience or provide an alternative language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description is entirely in Chinese and uses Chinese-only invocation examples, which can imply a fixed language/locale expectation. There is no note that the skill is China/Chinese-specific or that users may interact in other languages.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The security note minimizes risk by saying cookies are only passed to yt-dlp and not uploaded elsewhere, but the skill still extracts them from the local Chrome profile first. This mismatch can mislead users about the true sensitivity of the operation and reduce meaningful consent for handling browser authentication data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring, CLI description, and usage/help text are written entirely in Chinese, establishing a fixed language experience. Under the policy rule for natural-language violations, this is a locale/language constraint without an explicit user choice or opt-in.
- Content
Static analysis
No suspicious patterns detected.